Over the last few weeks I've been reading anything I could get my hands on about authentication and the different methods for securing and authenticating a user through a RESTful service, more specifically asp.net web api. This is really my first dive into http authentication and the more I've read the more confused I get.
Let me give some details on the application infrastructure of my project...
I'm building a RESTful service that will serve as the data access layer for a web application. The application itself will pretty much be a SPA built off of AngularJS. User login and CRUD operations will all be handled through the API and done over http NOT HTTPS.
I've read a lot of different articles/examples and I think I have a direction that makes sense for my goals. I'd like my approach to be similar to how Amazon Web Services does their authentication, and there's a great article on The Buzz Media that specifically describes how they do their authentication at a high level. I also found an example that closely resembles the high level description from the article (specifically the server code section).
But there are some things that I'm confused about...
- When the user logs in through the client (Angular in my case) the client will create a hash using the users password. The hash will contain the apikey, and a secret that only the api and client know. How is the secret obtained by the client when logging in? It seems like a request would first have to be made before logging in to get the secret, then create the hash and send another request to authenticate the user? A code example would be VERY helpful.
- Would I use a DelegatingHandler or create a custom Attrubite that I would decorate each controller with? Why?
- Once the user has been deemed authenticated I would then create a nonce which would be stored in the database for that user and returned in the response. The client would use this nonce in their next request. In the server code example link above the nonce is generated but is never sent back to the client. The example uses a custom Attribute, but I'm confused on how this nonce would be returned to the client in the response? Again, a code example would be VERY helpful.
- From there on out it's just the client hashing the apikey, nonce and data with every request and the API service sending back a new nonce in the response? Am I missing something?
